use validating http headers